@pareto4/pp-core 1.9.0 → 1.11.0

package/pp-core/bin/lib/vault-command-router.cjs

@@ -29,11 +29,62 @@
  */
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const { ERROR_REASON } = io;
 // Default CoreModule implementation. _core seam overrides this for test injection.
 const _defaultCore = { output: io.output };
+/**
+ * Render a short plain-text `vault org-profile` report from its structured
+ * shape — one line naming the pointer, one naming the resolution, a
+ * contributes list (or a "contributes nothing" line), an overridden list
+ * (D-05 drift made observable) prefixed by the precedence sentence, the
+ * ignored/rejected key names when non-empty, and the warnings verbatim.
+ * Kept to plain sentences a person can read without knowing pp-core
+ * internals (Phase 33-04).
+ */
+function renderOrgProfileReport(report) {
+    const lines = [];
+    if (report.pointer.value === null) {
+        lines.push('No org profile is configured (org.profile is unset) — pp-core\'s built-in defaults apply.');
+    }
+    else {
+        lines.push(`org.profile is set to "${report.pointer.value}".`);
+    }
+    if (report.profile.resolved) {
+        lines.push(`Resolved org profile "${report.profile.name}" version ${report.profile.version ?? 'unknown'} from ${report.profile.source}.`);
+    }
+    else if (report.pointer.value !== null) {
+        lines.push(`The org profile "${report.pointer.value}" could not be resolved from the project or the global npm root.`);
+    }
+    const contributesKeys = Object.keys(report.contributes);
+    if (contributesKeys.length === 0) {
+        lines.push('The org profile contributes nothing.');
+    }
+    else {
+        lines.push('The org profile contributes:');
+        for (const key of contributesKeys) {
+            lines.push(`  ${key} = ${report.contributes[key]}`);
+        }
+    }
+    if (report.overridden.length > 0) {
+        lines.push('A value the project sets itself always wins over anything an org profile contributes:');
+        for (const entry of report.overridden) {
+            lines.push(`  ${entry.key}: profile offered "${entry.profile}", but "${entry.effective}" won.`);
+        }
+    }
+    if (report.ignored.length > 0) {
+        lines.push(`Ignored (not on the allowlist): ${report.ignored.join(', ')}`);
+    }
+    if (report.rejected.length > 0) {
+        lines.push(`Rejected: ${report.rejected.join(', ')}`);
+    }
+    for (const warning of report.warnings) {
+        lines.push(warning);
+    }
+    return lines.join('\n');
+}
 // ─── Implementation ───────────────────────────────────────────────────────────
-function routeVaultCommand({ args, cwd, raw, error, _vault, _core }) {
+function routeVaultCommand({ args, cwd, raw, error, _vault, _core, _practices, _exec, _writeBack, _orgProfile, _coordinates, _provider, }) {
     // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
     const vault = _vault ?? require('./vault.cjs');
     const c = _core ?? _defaultCore;
@@ -47,8 +98,194 @@ function routeVaultCommand({ args, cwd, raw, error, _vault, _core }) {
     else if (subcommand === 'summary') {
         c.output(vault.vaultSummary(cwd), raw);
     }
+    else if (subcommand === 'practices') {
+        const verb = args[2];
+        if (verb === 'match') {
+            // T-24-08b: reject any unrecognized `--`-prefixed argument BEFORE the
+            // `--changed` git call (so a typo never spawns a subprocess) instead
+            // of silently filtering it out of the positional file list. Matched on
+            // the WHOLE token so `--files=…` is caught by the same check as
+            // `--files value`. DECISION (recorded, not deferred): `--files=` is
+            // NOT implemented as a comma-splitting alias here, unlike
+            // `/pp-code-review`'s `--files=a,b` (pp-core/workflows/code-review.md).
+            // The auditor marked the alias "optional and secondary"; the required
+            // behavior is loud failure, and the error message below names the
+            // supported forms instead. The host (pp-core/bin/pp-tools.cjs) already
+            // splices out its own global flags (--json-errors/--cwd/--ws/--raw/
+            // --pick/--default) before dispatch, which is why the recognized set
+            // here is only two flags wide.
+            const RECOGNIZED_MATCH_FLAGS = new Set(['--changed', '--raw', '--block']);
+            const unrecognizedFlag = args.slice(3).find((a) => a.startsWith('--') && !RECOGNIZED_MATCH_FLAGS.has(a));
+            if (unrecognizedFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedFlag}" for vault practices match. Supported: positional file paths, --changed, --raw, or --block.`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const practices = _practices ?? require('./vault-practices.cjs');
+            const runGit = _exec ?? shell_command_projection_cjs_1.execGit;
+            let files;
+            if (args.includes('--changed')) {
+                const gitResult = runGit(['diff', '--name-only', 'HEAD'], { cwd });
+                if (gitResult.exitCode !== 0) {
+                    error('Could not determine changed files: git diff failed (WR-02)', ERROR_REASON.SDK_FAIL_FAST);
+                    return;
+                }
+                files = gitResult.stdout.split('\n').map((f) => f.trim()).filter((f) => f.length > 0);
+            }
+            else {
+                files = args.slice(3).filter((a) => !a.startsWith('--'));
+            }
+            const result = practices.matchPractices({ cwd, files });
+            if (args.includes('--block')) {
+                // T-25-08: emit the finished <vault_practices> block so the planner
+                // embeds it VERBATIM. The planner never renames a field or applies a
+                // fence itself — that transformation used to be prose-only, which is
+                // what left the phase's prompt-injection mitigation unenforced.
+                c.output(result, true, practices.renderPracticesBlock(result));
+            }
+            else if (raw) {
+                c.output(result, true, JSON.stringify(result));
+            }
+            else {
+                c.output(result, true, practices.renderPracticesReport(result));
+            }
+        }
+        else if (verb === 'promote') {
+            // T-29-16: reject any unrecognized `--`-prefixed argument BEFORE the
+            // lazy require of the write-back module and before any subprocess can
+            // spawn — mirrors the `match` branch's T-24-08b guard exactly. Matched
+            // on the WHOLE token so `--name=value` is caught by the same check as
+            // `--name value`. The recognized set holds exactly three flags — no
+            // flag that disables, bypasses, or relaxes any guard exists.
+            const RECOGNIZED_PROMOTE_FLAGS = new Set(['--confirmed', '--expect', '--raw']);
+            const promoteArgs = args.slice(3);
+            const unrecognizedPromoteFlag = promoteArgs.find((a) => a.startsWith('--') && !RECOGNIZED_PROMOTE_FLAGS.has(a));
+            if (unrecognizedPromoteFlag !== undefined) {
+                error(`Unrecognized flag "${unrecognizedPromoteFlag}" for vault practices promote. Supported: --confirmed, --expect <token>, --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+                return;
+            }
+            // Positional file path: the first token that is not `--`-prefixed and
+            // is not the value immediately following `--expect`.
+            const expectFlagIdx = promoteArgs.indexOf('--expect');
+            const expectValueIdx = expectFlagIdx !== -1 ? expectFlagIdx + 1 : -1;
+            const filePath = promoteArgs.find((a, i) => !a.startsWith('--') && i !== expectValueIdx);
+            if (filePath === undefined) {
+                error('No practice file was given. Usage: vault practices promote <file> [--confirmed --expect <token>] [--raw].', ERROR_REASON.SDK_MISSING_ARG);
+                return;
+            }
+            const confirmed = promoteArgs.includes('--confirmed');
+            const expect = expectValueIdx !== -1 ? promoteArgs[expectValueIdx] : undefined;
+            if (confirmed && (expect === undefined || expect.startsWith('--'))) {
+                error('This practice was not pushed: the confirmation is missing the preview token it needs. ' +
+                    'Run the promotion without confirming first, then pass the token it prints.', ERROR_REASON.VAULT_PROMOTE_CONCURRENT_EDIT);
+                return;
+            }
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const writeBack = _writeBack ?? require('./vault-write-back.cjs');
+            const verdict = writeBack.promotePractice({ cwd, filePath, confirmed, expect });
+            // Emit the structured verdict BEFORE any error call — a refusal still
+            // carries its verdict to stdout. This ordering is the whole point of
+            // the uniform D-16 refusal contract and is what lets a wrapper
+            // workflow render results without scraping prose.
+            if (raw) {
+                c.output(verdict, true, JSON.stringify(verdict));
+            }
+            else {
+                c.output(verdict, true, writeBack.renderPromoteReport(verdict));
+            }
+            if (verdict.status === 'refused') {
+                // An action command's refusal must be observable in the exit code —
+                // do not adopt the ship gate's always-exit-zero convention here.
+                error(verdict.message ?? 'This practice was not promoted.', verdict.reason ?? ERROR_REASON.UNKNOWN);
+            }
+        }
+        else {
+            error('Unknown practices subcommand. Available: match, promote', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        }
+    }
+    else if (subcommand === 'org-profile') {
+        // T-33-13: reject any unrecognized `--`-prefixed argument BEFORE any
+        // lazy require or resolution work — mirrors the `practices match`
+        // T-24-08b guard exactly, so a typo can never trigger filesystem work.
+        const RECOGNIZED_ORG_PROFILE_FLAGS = new Set(['--raw']);
+        const unrecognizedOrgProfileFlag = args
+            .slice(2)
+            .find((a) => a.startsWith('--') && !RECOGNIZED_ORG_PROFILE_FLAGS.has(a));
+        if (unrecognizedOrgProfileFlag !== undefined) {
+            error(`Unrecognized flag "${unrecognizedOrgProfileFlag}" for vault org-profile. Supported: --raw.`, ERROR_REASON.SDK_FAIL_FAST);
+            return;
+        }
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+        const orgProfile = _orgProfile ?? require('./org-profile.cjs');
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+        const coordinates = _coordinates ?? require('./vault-coordinates.cjs');
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+        const providerModule = _provider ?? require('./git-provider.cjs');
+        const resolution = orgProfile.resolveOrgProfile(cwd);
+        // Resolve the EFFECTIVE values by calling the real resolvers, so the
+        // report shows what actually won rather than what the profile offered.
+        // `vault.fallback_host` has no standalone resolver of its own — the
+        // shared resolution's own `host` is the honest answer to "what host
+        // does the shared tier actually use", which is the question the
+        // operator is asking.
+        const { provider } = providerModule.resolveProvider(cwd);
+        const shared = coordinates.resolveSharedCoordinates(cwd, provider);
+        const platformHost = coordinates.resolvePlatformHost(cwd);
+        const effectiveByKey = {
+            'vault.provider': provider,
+            [coordinates.SHARED_REPO_CONFIG_KEY]: shared.repo,
+            [coordinates.SHARED_REF_CONFIG_KEY]: shared.ref,
+            [coordinates.SHARED_HOST_CONFIG_KEY]: shared.host,
+            [coordinates.PLATFORM_HOST_CONFIG_KEY]: platformHost.host,
+        };
+        // Build `effective`'s key list from ORG_PROFILE_ALLOWLIST rather than a
+        // fresh literal array, so a future allowlist change surfaces here
+        // automatically instead of silently dropping a key from the diagnostic.
+        const effective = {};
+        for (const key of orgProfile.ORG_PROFILE_ALLOWLIST) {
+            effective[key] = Object.prototype.hasOwnProperty.call(effectiveByKey, key) ? effectiveByKey[key] : null;
+        }
+        // `overridden` holds every key present in `contributes` whose
+        // contributed value is not strictly equal to its effective value — D-05's
+        // drift made observable, and the whole reason this command resolves
+        // effective values at all rather than just echoing the document.
+        const overridden = [];
+        for (const key of Object.keys(resolution.contributes)) {
+            const profileValue = resolution.contributes[key];
+            const effectiveValue = Object.prototype.hasOwnProperty.call(effective, key) ? effective[key] : null;
+            if (effectiveValue !== profileValue) {
+                overridden.push({ key, profile: profileValue, effective: effectiveValue });
+            }
+        }
+        const report = {
+            pointer: { key: orgProfile.ORG_PROFILE_CONFIG_KEY, value: resolution.configured },
+            profile: {
+                resolved: resolution.resolved,
+                name: resolution.packageName,
+                version: resolution.version,
+                source: resolution.source,
+                dataPath: resolution.dataPath,
+            },
+            contributes: resolution.contributes,
+            effective,
+            overridden,
+            ignored: resolution.ignored,
+            rejected: resolution.rejected,
+            warnings: resolution.warnings,
+        };
+        // Never call error() for a project with no profile, and never exit
+        // non-zero for a resolution failure — this is a diagnostic, not an
+        // action command (D-09's posture: a broken profile is a warning, not a
+        // failure).
+        if (raw) {
+            c.output(report, true, JSON.stringify(report));
+        }
+        else {
+            c.output(report, true, renderOrgProfileReport(report));
+        }
+    }
     else {
-        error('Unknown vault subcommand. Available: fetch, status, summary', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+        error('Unknown vault subcommand. Available: fetch, status, summary, practices, org-profile', ERROR_REASON.SDK_UNKNOWN_COMMAND);
     }
 }
 module.exports = {