@pareto4/pp-core 1.12.1 → 1.17.1

package/pp-core/bin/lib/shell-command-projection.cjs

@@ -15,6 +15,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.GIT_LOCATION_UNSET = exports.GIT_LOCATION_VARS = void 0;
 exports.hookCommandNeedsPowerShellCallOperator = hookCommandNeedsPowerShellCallOperator;
 exports.formatHookCommandForRuntime = formatHookCommandForRuntime;
 exports.shellHookOmitsBashRunner = shellHookOmitsBashRunner;
@@ -36,6 +37,7 @@ exports.renderShellActionLines = renderShellActionLines;
 exports.projectPathActionProjection = projectPathActionProjection;
 exports.projectPersistentPathExportActions = projectPersistentPathExportActions;
 exports.execGit = execGit;
+exports.execGitLocal = execGitLocal;
 exports.execNpm = execNpm;
 exports.execTool = execTool;
 exports.probeTty = probeTty;
@@ -412,10 +414,24 @@ function _spawnResult(result, program) {
         error: result.error ?? null,
     };
 }
+/**
+ * Run git bounded and non-interactive; never throws (`_spawnResult` maps a
+ * spawn error, a timeout or ENOBUFS to `exitCode: 1`).
+ *
+ * `input` (16-03) is written to git's stdin when given and nothing is passed
+ * otherwise, so every existing call behaves exactly as before. SEAL-01 passes
+ * revisions for `rev-list --stdin` through it rather than as argv, because a
+ * Windows command line is capped at 32767 characters (CreateProcess) and a
+ * long-lived project can record more anchors than that holds (16-RESEARCH
+ * Pitfall 6).
+ */
 function execGit(args, opts = {}) {
     // Non-interactive defaults: a hung credential prompt or terminal-input
     // probe must surface as a timeout, not block the tool forever. Callers
-    // can override via opts.env.
+    // can override via opts.env. A key whose opts.env value is `undefined`
+    // is UNSET for this call rather than inherited: spawnSync ignores an
+    // undefined env value (260915-mzx R2, proven by the inherited-GIT_DIR arm
+    // in tests/vault.test.cjs running real git).
     const env = {
         ...process.env,
         GIT_TERMINAL_PROMPT: '0',
@@ -429,9 +445,96 @@ function execGit(args, opts = {}) {
         stdio: 'pipe',
         timeout: opts.timeout ?? 10_000,
         windowsHide: true,
+        ...(opts.input !== undefined ? { input: opts.input } : {}),
     });
     return _spawnResult(result, 'git');
 }
+/**
+ * The repository-location variables: the ones through which git decides WHICH
+ * repository, work tree, index, object store, config file, ref namespace and
+ * history shape a command answers for (D-116, 16-UAT test 8). A git hook exports
+ * `GIT_DIR`; an agent shell may leave any of them pointing at another checkout. A
+ * vault git invocation must answer for the repository it names by cwd or argv,
+ * whatever the caller inherited.
+ *
+ * The list is git's, not hand-built (D-121, code review iteration 4 CR-01/WR-01):
+ * every name `git rev-parse --local-env-vars` prints (git 2.55.0) MINUS the stated
+ * keep-list `GIT_CONFIG_PARAMETERS` and `GIT_CONFIG_COUNT` — the `GIT_CONFIG_*`
+ * channel D-117 keeps, with its `GIT_CONFIG_KEY_n`/`GIT_CONFIG_VALUE_n` pairs, for
+ * the suite's hermetic config and the golden harness's insteadOf rewrite — PLUS
+ * three names git does not list but that move discovery or the ref namespace
+ * (`GIT_CEILING_DIRECTORIES`, `GIT_DISCOVERY_ACROSS_FILESYSTEM`, `GIT_NAMESPACE`).
+ * It stays a static tuple: the engine never shells out to git to build it, and a
+ * test compares it against the live git so a name a future git adds cannot arrive
+ * unremarked.
+ *
+ * Four of them move an ancestry answer inside ONE repository (measured, git
+ * 2.55.0): `GIT_SHALLOW_FILE` naming the second of three commits dropped
+ * `rev-list --count HEAD` from 3 to 2 and flipped `merge-base --is-ancestor
+ * <first> HEAD` to no; `GIT_REPLACE_REF_BASE` naming a planted `refs/evil/`
+ * replacement of HEAD made `rev-parse HEAD^` answer the first commit;
+ * `GIT_NO_REPLACE_OBJECTS=1` hides a repository's own `refs/replace/` entries the
+ * same way; `GIT_GRAFT_FILE` naming an ungoverned commit made it a root, and the
+ * strict `check vault.trace` then answered clean over it (CR-01). `GIT_CONFIG` is
+ * a location variable, not transport: it names ONE config file and is read only
+ * by the `git config` command, for reads and writes alike, so inherited it sent
+ * promote's identity step into a foreign file (WR-01). This tuple is the only
+ * enumeration: `GIT_LOCATION_UNSET` is derived from it.
+ */
+exports.GIT_LOCATION_VARS = Object.freeze([
+    'GIT_DIR',
+    'GIT_WORK_TREE',
+    'GIT_COMMON_DIR',
+    'GIT_INDEX_FILE',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_ALTERNATE_OBJECT_DIRECTORIES',
+    'GIT_PREFIX',
+    'GIT_CEILING_DIRECTORIES',
+    'GIT_DISCOVERY_ACROSS_FILESYSTEM',
+    'GIT_NAMESPACE',
+    'GIT_SHALLOW_FILE',
+    'GIT_REPLACE_REF_BASE',
+    'GIT_NO_REPLACE_OBJECTS',
+    'GIT_GRAFT_FILE',
+    'GIT_IMPLICIT_WORK_TREE',
+    'GIT_CONFIG',
+]);
+/**
+ * The overlay `execGitLocal` applies: every `GIT_LOCATION_VARS` member as an own
+ * property equal to `undefined` (spawnSync treats an undefined env value as unset).
+ * Derived from the tuple, never written out, so there is one list. Exported only
+ * for a spawn that cannot go through `execGitLocal` — the `glab` clone, which
+ * runs through `execTool` and whose own git child inherits this environment
+ * (D-116).
+ */
+exports.GIT_LOCATION_UNSET = Object.freeze(Object.fromEntries(exports.GIT_LOCATION_VARS.map((name) => [name, undefined])));
+/**
+ * Run git exactly as `execGit` does, with every inherited repository-location
+ * variable (`GIT_LOCATION_VARS`) unset — the one owner of the environment of a
+ * vault git invocation (D-116, D-117). "Local" means the repository is chosen by
+ * cwd or argv and never by the environment, which is why the URL-addressed
+ * transport invocations (clones, `ls-remote`) use it too: git still reads the
+ * config of the repository the environment selects, and a clone refuses an
+ * inherited `GIT_WORK_TREE` and writes into an inherited `GIT_INDEX_FILE`.
+ *
+ * It is location-only, not the whole `GIT_*` prefix: transport (`GIT_SSH_COMMAND`,
+ * `GIT_ASKPASS`, the credential-helper family) is kept for the base-branch
+ * ladder's remote tier, every clone and the promote push; the `GIT_CONFIG_*`
+ * channel (`GIT_CONFIG_PARAMETERS`, `GIT_CONFIG_COUNT` and its pairs, the keep-list
+ * D-117/D-121 name) is kept because it keeps the suite's reads hermetic and carries
+ * the golden harness's insteadOf rewrite to its local bare vault; the legacy
+ * one-file `GIT_CONFIG` is a location variable and is unset. The two reads that
+ * must depend on no inherited git variable at all (certify, the cache resolver)
+ * keep the whole-prefix `scrubbedGitEnv` in `src/vault.cts`, a superset of this
+ * overlay.
+ *
+ * The overlay is applied LAST, over any caller `opts.env`, so no call site can
+ * re-point the repository; `cwd`, `timeout` and `input` are forwarded unchanged.
+ */
+function execGitLocal(args, opts = {}) {
+    const env = { ...(opts.env || {}), ...exports.GIT_LOCATION_UNSET };
+    return execGit(args, { ...opts, env });
+}
 function execNpm(args, opts = {}) {
     const result = node_child_process_1.default.spawnSync('npm', args, {
         cwd: opts.cwd,

package/pp-core/bin/lib/state.cjs

@@ -19,7 +19,7 @@ const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { escapeRegex, normalizePhaseName } = phaseIdMod;
+const { escapeRegex } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
 const { getDeclaredMilestoneInfo, getMilestonePhaseFilter, extractCurrentMilestone, getClosedMilestonePhaseDirFilter } = roadmapParserMod;
@@ -76,9 +76,9 @@ function cmdStateLoad(cwd, raw) {
     const configExists = node_fs_1.default.existsSync(node_path_1.default.join(planDir, 'config.json'));
     const roadmapExists = node_fs_1.default.existsSync(node_path_1.default.join(planDir, 'ROADMAP.md'));
     const stateExists = stateRaw.length > 0;
-    // Pack 6 D-07: the emitted config is display-safe for its remote coordinate
-    // key (config.cjs's projection); `config` itself stays raw. Lazily required
-    // so this module's load graph is unchanged.
+    // VAULT-EGRESS-1: the emitted config is display-safe for its one coordinate key (the
+    // shared-tier repo), through config.cjs's projection; `config` itself stays raw. Lazily
+    // required so this module's load graph is unchanged.
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     const { redactConfigCoordinates } = require('./config.cjs');
     const result = {
@@ -181,23 +181,17 @@ function cmdStatePatch(cwd, patches, raw) {
         const shouldResync = shouldResyncStateProgress(Object.keys(patches));
         // Use atomic read-modify-write to prevent lost updates from concurrent agents
         const fmReport = readModifyWriteStateMd(statePath, (content) => {
-            // Patch the BODY only, as cmdStateUpdate does. The plain-line pattern is
-            // case-insensitive, so on the whole file `Status` matched the frontmatter
-            // `status:` line first; the re-derivation then restored it from the untouched
-            // body, and the verb reported a write it never made.
-            let body = stripFrontmatter(content);
-            const head = content.slice(0, content.length - body.length);
             for (const [field, value] of Object.entries(patches)) {
-                const result = (0, state_document_cjs_1.stateReplaceField)(body, field, value);
+                const result = (0, state_document_cjs_1.stateReplaceField)(content, field, value);
                 if (result) {
-                    body = result;
+                    content = result;
                     results.updated.push(field);
                 }
                 else {
                     results.failed.push(field);
                 }
             }
-            return head + body;
+            return content;
         }, cwd, { resync: shouldResync });
         output({ ...results, frontmatter_updated: fmReport.frontmatter_updated }, raw, results.updated.length > 0 ? 'true' : 'false');
     }
@@ -1285,20 +1279,7 @@ function cmdStateSnapshot(cwd, raw) {
  * or the first Built phase of a milestone would be counted Complete.
  */
 function roadmapCompletedPhases(roadmapRaw, roadmapScope) {
-    // The phases the current milestone's scope names. A progress table may also carry a
-    // shipped milestone's rows (the template's milestone-grouped layout keeps them, with a
-    // Milestone column): those rows grant nothing to this milestone.
-    const scopedIds = new Set();
-    const headingPattern = /#{2,4}\s*Phase\s+([\w][\w.-]*)\s*:/gi;
-    let hm;
-    while ((hm = headingPattern.exec(roadmapScope)) !== null) {
-        if (/\d/.test(hm[1]))
-            scopedIds.add(normalizePhaseName(hm[1]));
-    }
     const fromText = (text) => {
-        const table = countCompleteProgressRows(text, scopedIds);
-        if (table !== null)
-            return table;
         const derived = deriveProgressFromRoadmap(text);
         if (derived.completedPhases !== null)
             return derived.completedPhases;
@@ -1309,51 +1290,6 @@ function roadmapCompletedPhases(roadmapRaw, roadmapScope) {
         return scoped;
     return fromText(extractCurrentMilestone(roadmapRaw));
 }
-/**
- * Column-aware read of a ROADMAP progress table: the header row names the `Phase` and
- * `Status` columns, so a table with a Milestone column (pp-core/templates/roadmap.md's
- * milestone-grouped layout) is read as well as the four-column one. Counts the data
- * rows whose Status cell is `Complete`, among the rows whose phase is in `phaseIds`
- * (all rows when `phaseIds` is empty). Returns null when no such table is present, or
- * when the table lists none of `phaseIds` — a table that says nothing about this
- * milestone's phases is silence, not a grant of zero.
- */
-function countCompleteProgressRows(text, phaseIds) {
-    const cellsOf = (line) => {
-        const t = line.trim();
-        if (!t.startsWith('|'))
-            return null;
-        return t.replace(/^\|/, '').replace(/\|$/, '').split('|').map((c) => c.trim());
-    };
-    const lines = text.split(/\r?\n/);
-    for (let i = 0; i + 1 < lines.length; i++) {
-        const header = cellsOf(lines[i]);
-        if (!header)
-            continue;
-        const phaseCol = header.findIndex((c) => /^phase$/i.test(c));
-        const statusCol = header.findIndex((c) => /^status$/i.test(c));
-        const separator = cellsOf(lines[i + 1]);
-        if (phaseCol === -1 || statusCol === -1 || !separator || !separator.every((c) => /^:?-+:?$/.test(c)))
-            continue;
-        let listed = 0;
-        let complete = 0;
-        for (let j = i + 2; j < lines.length; j++) {
-            const cells = cellsOf(lines[j]);
-            if (!cells)
-                break;
-            const id = cells[phaseCol] ?? '';
-            if (!/^\d/.test(id))
-                continue;
-            if (phaseIds.size > 0 && !phaseIds.has(normalizePhaseName(id)))
-                continue;
-            listed++;
-            if (/^complete$/i.test(cells[statusCol] ?? ''))
-                complete++;
-        }
-        return listed > 0 ? complete : null;
-    }
-    return null;
-}
 /**
  * Read the milestone-scoped ROADMAP once and return the two counts the progress
  * block takes from it: the digit-bearing phase headings (single source of truth
@@ -2406,23 +2342,13 @@ function updatePerformanceMetricsSection(content, cwd, phaseNum, planCount, summ
     const byPhaseMatch = content.match(byPhaseTablePattern);
     if (byPhaseMatch) {
         let tableBody = byPhaseMatch[2].trim();
-        // The row for this phase is found by phase IDENTITY, not by the literal argument:
-        // `phase complete 4` must update a row spelled `04` (and vice versa), never append
-        // a second row for the same phase. The row keeps its own id spelling.
-        const wanted = normalizePhaseName(String(phaseNum));
-        const lines = tableBody.split('\n');
-        const rowIdx = lines.findIndex((line) => {
-            const cell = /^\|\s*([^|]*?)\s*\|/.exec(line);
-            return cell !== null && /^[A-Za-z0-9.-]+$/.test(cell[1]) && normalizePhaseName(cell[1]) === wanted;
-        });
-        if (rowIdx !== -1) {
+        const phaseRowPattern = new RegExp(`^\\|\\s*${escapeRegex(String(phaseNum))}\\s*\\|.*$`, 'm');
+        const newRow = `| ${phaseNum} | ${summaryCount} | - | - |`;
+        if (phaseRowPattern.test(tableBody)) {
             // Update existing row
-            const rowId = /^\|\s*([^|]*?)\s*\|/.exec(lines[rowIdx])[1];
-            lines[rowIdx] = `| ${rowId} | ${summaryCount} | - | - |`;
-            tableBody = lines.join('\n');
+            tableBody = tableBody.replace(phaseRowPattern, newRow);
         }
         else {
-            const newRow = `| ${phaseNum} | ${summaryCount} | - | - |`;
             // Remove placeholder row and add new row
             tableBody = tableBody.replace(/^\|\s*-\s*\|\s*-\s*\|\s*-\s*\|\s*-\s*\|$/m, '').trim();
             tableBody = tableBody ? tableBody + '\n' + newRow : newRow;

package/pp-core/bin/lib/template.cjs

@@ -79,7 +79,7 @@ function cmdTemplateFill(cwd, templateType, options, raw) {
     if (!options.phase) {
         error('--phase required');
     }
-    // D-02 (todo "template-fill-writes-into-an-archived-
+    // PBI 75323 / quick 261009-gvf D-02 (todo "template-fill-writes-into-an-archived-
     // phase-directory"): a writer never resolves into a closed milestone's archive. The
     // phase-scope owner hands back a live match only; an archive this phase still names
     // (current milestone, or no longer on the ROADMAP) is refused naming the archive, and a